Hi Noel, Thanks for replying. Here is the output of iptables-save and ip6tables-save:
root@snf-823515:~# iptables-save # Generated by iptables-save v1.6.1 on Sat Jun 2 23:38:02 2018 *mangle :PREROUTING ACCEPT [1267325:876958065] :INPUT ACCEPT [1237708:851646057] :FORWARD ACCEPT [29479:25297360] :OUTPUT ACCEPT [1254056:1043029543] :POSTROUTING ACCEPT [1283535:1068326903] -A FORWARD -s 172.18.72.0/24 -o eth1 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -s 172.18.73.0/24 -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu COMMIT # Completed on Sat Jun 2 23:38:02 2018 # Generated by iptables-save v1.6.1 on Sat Jun 2 23:38:02 2018 *nat :PREROUTING ACCEPT [80004:7959890] :INPUT ACCEPT [79118:7842531] :OUTPUT ACCEPT [8028:605426] :POSTROUTING ACCEPT [8029:605466] -A POSTROUTING -s 172.18.72.0/24 -o eth1 -m policy --dir out --pol ipsec -j ACCEPT -A POSTROUTING -s 172.18.73.0/24 -o eth1 -j SNAT --to-source 83.212.111.156 --persistent -A POSTROUTING -s 172.18.72.0/24 -o eth1 -j SNAT --to-source 83.212.111.156 --persistent COMMIT # Completed on Sat Jun 2 23:38:02 2018 # Generated by iptables-save v1.6.1 on Sat Jun 2 23:38:02 2018 *filter :INPUT ACCEPT [79598:7901697] :FORWARD ACCEPT [522:75308] :OUTPUT ACCEPT [1254057:1043029895] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p udp -m udp --dport 500 -j ACCEPT -A INPUT -p udp -m udp --dport 4500 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 25 -j REJECT --reject-with tcp-reset -A INPUT -i eth1 -p tcp -m tcp --dport 25 -j REJECT --reject-with tcp-reset -A FORWARD -s 172.18.72.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A FORWARD -d 172.18.72.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT COMMIT # Completed on Sat Jun 2 23:38:02 2018 root@snf-823515:~# ip6tables-save # Generated by ip6tables-save v1.6.1 on Sat Jun 2 23:39:30 2018 *filter :INPUT ACCEPT [9613:6437361] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [7799:673126] -A INPUT -i eth0 -p tcp -m tcp --dport 25 -j REJECT --reject-with tcp-reset COMMIT # Completed on Sat Jun 2 23:39:30 2018 Thanks, GeorgeM > On Jun 2, 2018, at 23:35, Noel Kuntze > <[email protected]> wrote: > > Hello, > > Please provide your iptables and ip6tables rules. Use iptables-save and > ip6tables-save. > > Kind regards > > Noel > > On 01.06.2018 23:15, Giorgos Mavrikas wrote: >> Hi, >> >> I have a problem that’s been bugging me for two days straight. I have looked >> into the wiki documentation regarding routing, but I cannot figure this out. >> Any help would be much appreciated. >> I have a simple “road warrior” type setup, with SW listening on both v4 and >> v6. I want clients to be able to connect to both v4 and v6, but the tunnel >> should only carry v4 traffic. >> The v4 part works great. The v6 part connects OK (after some extra module >> loading) and tunnel traffic gets all the way from the client to the external >> interface of the server where it get’s NAT-ted and a reply is received. >> After that, the packet gets missing, it’s never received on the client’s >> tunnel interface. I cannot find out why this happens, all xfrm policies look >> good to my eyes. >> >> Snoop on the client (macOS) >> gmvmbp15r:~ root# tcpdump -ni ipsec0 icmp >> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode >> listening on ipsec0, link-type NULL (BSD loopback), capture size 262144 bytes >> 00:11:43.251689 IP 172.18.72.1 > 1.1.1.1: ICMP echo request, id 5125, seq 3, >> length 64 >> 00:11:44.253234 IP 172.18.72.1 > 1.1.1.1: ICMP echo request, id 5125, seq 4, >> length 64 >> 00:11:45.257160 IP 172.18.72.1 > 1.1.1.1: ICMP echo request, id 5125, seq 5, >> length 64 >> 00:11:46.258467 IP 172.18.72.1 > 1.1.1.1: ICMP echo request, id 5125, seq 6, >> length 64 >> >> Snoop on the public interface of the server (Ubuntu 18.04) >> root@snf-823515:~# tcpdump -ni eth1 icmp >> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode >> listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes >> 00:11:46.257089 IP 83.212.111.156 > 1.1.1.1: ICMP echo request, id 5125, seq >> 6, length 64 >> 00:11:46.259361 IP 1.1.1.1 > 83.212.111.156: ICMP echo reply, id 5125, seq >> 6, length 64 >> 00:11:47.274263 IP 83.212.111.156 > 1.1.1.1: ICMP echo request, id 5125, seq >> 7, length 64 >> 00:11:47.276714 IP 1.1.1.1 > 83.212.111.156: ICMP echo reply, id 5125, seq >> 7, length 64 >> >> Thanks for taking the time! >> >> My config follows. >> >> -> ipsec.conf >> config setup >> charondebug="ike 1, knl 1, cfg 0" >> uniqueids=no >> >> conn ikev2-vpn >> auto=add >> compress=no >> type=tunnel >> keyexchange=ikev2 >> fragmentation=yes >> forceencaps=no >> >> ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024! >> >> esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128gcm16,aes256gcm16,aes128-sha256,aes128-sha1,aes256-sha384,aes256-sha256,aes256-sha1! >> dpdaction=clear >> dpddelay=300s >> rekey=no >> left=%any >> [email protected] <mailto:[email protected]> >> leftcert=/etc/letsencrypt/live/tunnel2.mavrikas.com/fullchain.pem >> <http://tunnel2.mavrikas.com/fullchain.pem> >> leftsendcert=always >> leftsubnet=0.0.0.0/0 >> right=%any >> rightid=%any >> rightauth=eap-mschapv2 >> rightsourceip=172.18.72.0/24 >> rightdns=1.0.0.1,1.1.1.1 >> rightsendcert=never >> eap_identity=%identity >> >> -> v4 connection log (all OK): >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 00[DMN] Starting IKE charon daemon >> (strongSwan 5.6.2, Linux 4.15.0-1010-kvm, x86_64) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 00[LIB] loaded plugins: charon aes >> rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey >> pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent >> xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke >> updown eap-mschapv2 xauth-generic counters >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 00[LIB] dropped capabilities, >> running as uid 0, gid 0 >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 00[JOB] spawning 16 worker threads >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 07[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[500] (604 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 07[ENC] parsed IKE_SA_INIT request 0 >> [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 07[IKE] >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8 is initiating an IKE_SA >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 07[ENC] generating IKE_SA_INIT >> response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 07[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[500] (448 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (512 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[ENC] unknown attribute type (25) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[ENC] parsed IKE_AUTH request 1 [ >> IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 >> DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[IKE] EAP-Identity request >> configured, but not supported >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[IKE] initiating EAP_MSCHAPV2 >> method (id 0xFB) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[IKE] received >> ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[IKE] peer supports MOBIKE >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[IKE] authentication of >> 'tunnel2.mavrikas.com <http://tunnel2.mavrikas.com>' (myself) with RSA >> signature successful >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[IKE] sending end entity cert >> "CN=tunnel2.mavrikas.com <http://tunnel2.mavrikas.com>" >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[ENC] generating IKE_AUTH response >> 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[ENC] splitting IKE message with >> length of 1968 bytes into 2 fragments >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[ENC] generating IKE_AUTH response >> 1 [ EF(1/2) ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[ENC] generating IKE_AUTH response >> 1 [ EF(2/2) ] >> Jun 2 00:04:22 snf-823515 charon: 11[IKE] IKE_SA ikev2-vpn[1] established >> between >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[tunnel2.mavrikas.com<http://tunnel2.mavrikas.com>]...2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[gmvmbp15r] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (1220 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 08[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (820 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 09[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (144 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 09[ENC] parsed IKE_AUTH request 2 [ >> EAP/RES/MSCHAPV2 ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 09[IKE] EAP-MS-CHAPv2 username: 'gmv' >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 09[ENC] generating IKE_AUTH response >> 2 [ EAP/REQ/MSCHAPV2 ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 09[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (144 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 10[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (80 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 10[ENC] parsed IKE_AUTH request 3 [ >> EAP/RES/MSCHAPV2 ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 10[IKE] EAP method EAP_MSCHAPV2 >> succeeded, MSK established >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 10[ENC] generating IKE_AUTH response >> 3 [ EAP/SUCC ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 10[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (80 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (112 bytes) >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[ENC] parsed IKE_AUTH request 4 [ >> AUTH ] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] authentication of >> 'gmvmbp15r' with EAP successful >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] authentication of >> 'tunnel2.mavrikas.com <http://tunnel2.mavrikas.com>' (myself) with EAP >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] IKE_SA ikev2-vpn[1] >> established between >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[tunnel2.mavrikas.com<http://tunnel2.mavrikas.com>]...2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[gmvmbp15r] >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] peer requested virtual IP >> %any >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] assigning virtual IP >> 172.18.72.1 to peer 'gmv' >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] peer requested virtual IP >> %any6 >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] no virtual IP found for >> %any6 requested by 'gmv' >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[IKE] CHILD_SA ikev2-vpn{1} >> established with SPIs c64b8761_i 0e498bf1_o and TS 0.0.0.0/0 === >> 172.18.72.1/32 >> Jun 2 00:04:22 snf-823515 ipsec[2733]: 11[ENC] generating IKE_AUTH response >> 4 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) >> N(ADD_4_ADDR) N(ADD_4_ADDR) ] >> Jun 2 00:04:22 snf-823515 charon: 11[IKE] peer requested virtual IP %any >> Jun 2 00:04:22 snf-823515 charon: 11[IKE] assigning virtual IP 172.18.72.1 >> to peer 'gmv' >> Jun 2 00:04:22 snf-823515 charon: 11[IKE] peer requested virtual IP %any6 >> Jun 2 00:04:22 snf-823515 charon: 11[IKE] no virtual IP found for %any6 >> requested by 'gmv' >> Jun 2 00:04:22 snf-823515 charon: 11[IKE] CHILD_SA ikev2-vpn{1} established >> with SPIs c64b8761_i 0e498bf1_o and TS 0.0.0.0/0 === 172.18.72.1/32 >> Jun 2 00:04:22 snf-823515 charon: 11[ENC] generating IKE_AUTH response 4 [ >> AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) >> N(ADD_4_ADDR) ] >> Jun 2 00:04:22 snf-823515 charon: 11[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (288 bytes) >> >> -> v6 connection log >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 00[DMN] Starting IKE charon daemon >> (strongSwan 5.6.2, Linux 4.15.0-1010-kvm, x86_64) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 00[LIB] loaded plugins: charon aes >> rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey >> pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent >> xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke >> updown eap-mschapv2 xauth-generic counters >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 00[LIB] dropped capabilities, >> running as uid 0, gid 0 >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 00[JOB] spawning 16 worker threads >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 07[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[500] (604 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 07[ENC] parsed IKE_SA_INIT request 0 >> [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 07[IKE] >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8 is initiating an IKE_SA >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 07[ENC] generating IKE_SA_INIT >> response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 07[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[500] (448 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (512 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[ENC] unknown attribute type (25) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[ENC] parsed IKE_AUTH request 1 [ >> IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 >> DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[IKE] EAP-Identity request >> configured, but not supported >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[IKE] initiating EAP_MSCHAPV2 >> method (id 0x5E) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[IKE] received >> ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[IKE] peer supports MOBIKE >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[IKE] authentication of >> 'tunnel2.mavrikas.com <http://tunnel2.mavrikas.com>' (myself) with RSA >> signature successful >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[IKE] sending end entity cert >> "CN=tunnel2.mavrikas.com <http://tunnel2.mavrikas.com>" >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[ENC] generating IKE_AUTH response >> 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[ENC] splitting IKE message with >> length of 1968 bytes into 2 fragments >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[ENC] generating IKE_AUTH response >> 1 [ EF(1/2) ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[ENC] generating IKE_AUTH response >> 1 [ EF(2/2) ] >> Jun 2 00:05:30 snf-823515 charon: 11[IKE] IKE_SA ikev2-vpn[1] established >> between >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[tunnel2.mavrikas.com<http://tunnel2.mavrikas.com>]...2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[gmvmbp15r] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (1220 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 08[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (820 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 09[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (144 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 09[ENC] parsed IKE_AUTH request 2 [ >> EAP/RES/MSCHAPV2 ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 09[IKE] EAP-MS-CHAPv2 username: 'gmv' >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 09[ENC] generating IKE_AUTH response >> 2 [ EAP/REQ/MSCHAPV2 ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 09[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (144 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 10[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (80 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 10[ENC] parsed IKE_AUTH request 3 [ >> EAP/RES/MSCHAPV2 ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 10[IKE] EAP method EAP_MSCHAPV2 >> succeeded, MSK established >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 10[ENC] generating IKE_AUTH response >> 3 [ EAP/SUCC ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 10[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (80 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[NET] received packet: from >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] to >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] (112 bytes) >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[ENC] parsed IKE_AUTH request 4 [ >> AUTH ] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] authentication of >> 'gmvmbp15r' with EAP successful >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] authentication of >> 'tunnel2.mavrikas.com <http://tunnel2.mavrikas.com>' (myself) with EAP >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] IKE_SA ikev2-vpn[1] >> established between >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[tunnel2.mavrikas.com<http://tunnel2.mavrikas.com>]...2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[gmvmbp15r] >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] peer requested virtual IP >> %any >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] assigning virtual IP >> 172.18.72.1 to peer 'gmv' >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] peer requested virtual IP >> %any6 >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] no virtual IP found for >> %any6 requested by 'gmv' >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[IKE] CHILD_SA ikev2-vpn{1} >> established with SPIs c319aa3c_i 0858c6f9_o and TS 0.0.0.0/0 === >> 172.18.72.1/32 >> Jun 2 00:05:30 snf-823515 ipsec[2935]: 11[ENC] generating IKE_AUTH response >> 4 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) >> N(ADD_4_ADDR) N(ADD_4_ADDR) ] >> Jun 2 00:05:30 snf-823515 charon: 11[IKE] peer requested virtual IP %any >> Jun 2 00:05:30 snf-823515 charon: 11[IKE] assigning virtual IP 172.18.72.1 >> to peer 'gmv' >> Jun 2 00:05:30 snf-823515 charon: 11[IKE] peer requested virtual IP %any6 >> Jun 2 00:05:30 snf-823515 charon: 11[IKE] no virtual IP found for %any6 >> requested by 'gmv' >> Jun 2 00:05:30 snf-823515 charon: 11[IKE] CHILD_SA ikev2-vpn{1} established >> with SPIs c319aa3c_i 0858c6f9_o and TS 0.0.0.0/0 === 172.18.72.1/32 >> Jun 2 00:05:30 snf-823515 charon: 11[ENC] generating IKE_AUTH response 4 [ >> AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) >> N(ADD_4_ADDR) ] >> Jun 2 00:05:30 snf-823515 charon: 11[NET] sending packet: from >> 2001:648:2ffc:1225:a800:4ff:fe1e:a37e[4500] to >> 2a02:1388:2185:a7ab:d5ce:d99f:aec6:66d8[4500] (288 bytes) >> >> -> routing tables after v4 gets connected (ignore the tun* interfaces, they >> belong to OpenVPN) >> 172.18.72.1 via 83.212.110.1 dev eth1 table 220 proto static >> default via 83.212.110.1 dev eth1 proto dhcp metric 101 >> 83.212.110.0/23 dev eth1 proto kernel scope link src 83.212.111.156 metric >> 101 >> 172.18.73.0/24 via 172.18.73.2 dev tun1 >> 172.18.73.2 dev tun1 proto kernel scope link src 172.18.73.1 >> 172.18.73.2 dev tun0 proto kernel scope link src 172.18.73.1 >> broadcast 83.212.110.0 dev eth1 table local proto kernel scope link src >> 83.212.111.156 >> local 83.212.111.156 dev eth1 table local proto kernel scope host src >> 83.212.111.156 >> broadcast 83.212.111.255 dev eth1 table local proto kernel scope link src >> 83.212.111.156 >> broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 >> local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 >> local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 >> broadcast 127.255.255.255 dev lo table local proto kernel scope link src >> 127.0.0.1 >> local 172.18.73.1 dev tun1 table local proto kernel scope host src >> 172.18.73.1 >> local 172.18.73.1 dev tun0 table local proto kernel scope host src >> 172.18.73.1 >> local ::1 dev lo proto kernel metric 256 pref medium >> 2001:648:2ffc:1225::/64 dev eth0 proto ra metric 100 pref medium >> fe80::/64 dev eth0 proto kernel metric 100 pref medium >> fe80::/64 dev eth1 proto kernel metric 101 pref medium >> fe80::/64 dev eth0 proto kernel metric 256 pref medium >> fe80::/64 dev eth1 proto kernel metric 256 pref medium >> fe80::/64 dev tun1 proto kernel metric 256 pref medium >> fe80::/64 dev tun0 proto kernel metric 256 pref medium >> default via fe80::ce47:52ff:fe4e:4554 dev eth0 proto ra metric 100 pref high >> local ::1 dev lo table local proto kernel metric 0 pref medium >> local 2001:648:2ffc:1225:a800:4ff:fe1e:a37e dev eth0 table local proto >> kernel metric 0 pref medium >> local fe80::3948:27b7:f4d2:fa55 dev eth1 table local proto kernel metric 0 >> pref medium >> local fe80::8c31:575c:4950:fa28 dev tun0 table local proto kernel metric 0 >> pref medium >> local fe80::a800:4ff:fe1e:a37e dev eth0 table local proto kernel metric 0 >> pref medium >> local fe80::e403:923b:5769:5de dev tun1 table local proto kernel metric 0 >> pref medium >> ff00::/8 dev eth0 table local metric 256 pref medium >> ff00::/8 dev eth1 table local metric 256 pref medium >> ff00::/8 dev tun1 table local metric 256 pref medium >> ff00::/8 dev tun0 table local metric 256 pref medium >> >> -> routing tables after v6 gets connected >> 172.18.72.1 via 83.212.110.1 dev eth1 table 220 proto static >> default via 83.212.110.1 dev eth1 proto dhcp metric 101 >> 83.212.110.0/23 dev eth1 proto kernel scope link src 83.212.111.156 metric >> 101 >> 172.18.73.0/24 via 172.18.73.2 dev tun1 >> 172.18.73.2 dev tun1 proto kernel scope link src 172.18.73.1 >> 172.18.73.2 dev tun0 proto kernel scope link src 172.18.73.1 >> broadcast 83.212.110.0 dev eth1 table local proto kernel scope link src >> 83.212.111.156 >> local 83.212.111.156 dev eth1 table local proto kernel scope host src >> 83.212.111.156 >> broadcast 83.212.111.255 dev eth1 table local proto kernel scope link src >> 83.212.111.156 >> broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 >> local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 >> local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 >> broadcast 127.255.255.255 dev lo table local proto kernel scope link src >> 127.0.0.1 >> local 172.18.73.1 dev tun1 table local proto kernel scope host src >> 172.18.73.1 >> local 172.18.73.1 dev tun0 table local proto kernel scope host src >> 172.18.73.1 >> local ::1 dev lo proto kernel metric 256 pref medium >> 2001:648:2ffc:1225::/64 dev eth0 proto ra metric 100 pref medium >> fe80::/64 dev eth0 proto kernel metric 100 pref medium >> fe80::/64 dev eth1 proto kernel metric 101 pref medium >> fe80::/64 dev eth0 proto kernel metric 256 pref medium >> fe80::/64 dev eth1 proto kernel metric 256 pref medium >> fe80::/64 dev tun1 proto kernel metric 256 pref medium >> fe80::/64 dev tun0 proto kernel metric 256 pref medium >> default via fe80::ce47:52ff:fe4e:4554 dev eth0 proto ra metric 100 pref high >> local ::1 dev lo table local proto kernel metric 0 pref medium >> local 2001:648:2ffc:1225:a800:4ff:fe1e:a37e dev eth0 table local proto >> kernel metric 0 pref medium >> local fe80::3948:27b7:f4d2:fa55 dev eth1 table local proto kernel metric 0 >> pref medium >> local fe80::8c31:575c:4950:fa28 dev tun0 table local proto kernel metric 0 >> pref medium >> local fe80::a800:4ff:fe1e:a37e dev eth0 table local proto kernel metric 0 >> pref medium >> local fe80::e403:923b:5769:5de dev tun1 table local proto kernel metric 0 >> pref medium >> ff00::/8 dev eth0 table local metric 256 pref medium >> ff00::/8 dev eth1 table local metric 256 pref medium >> ff00::/8 dev tun1 table local metric 256 pref medium >> ff00::/8 dev tun0 table local metric 256 pref medium >> >> -> interface configuration >> root@snf-823515:~# ip addr ls >> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group >> default qlen 1000 >> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 >> inet 127.0.0.1/8 scope host lo >> valid_lft forever preferred_lft forever >> inet6 ::1/128 scope host >> valid_lft forever preferred_lft forever >> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state >> UP group default qlen 1000 >> link/ether aa:00:04:1e:a3:7e brd ff:ff:ff:ff:ff:ff >> inet6 2001:648:2ffc:1225:a800:4ff:fe1e:a37e/64 scope global noprefixroute >> valid_lft forever preferred_lft forever >> inet6 fe80::a800:4ff:fe1e:a37e/64 scope link noprefixroute >> valid_lft forever preferred_lft forever >> 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state >> UP group default qlen 1000 >> link/ether aa:0c:f4:7b:f9:1d brd ff:ff:ff:ff:ff:ff >> inet 83.212.111.156/23 brd 83.212.111.255 scope global dynamic >> noprefixroute eth1 >> valid_lft 603582sec preferred_lft 603582sec >> inet6 fe80::3948:27b7:f4d2:fa55/64 scope link noprefixroute >> valid_lft forever preferred_lft forever >> 4: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000 >> link/sit 0.0.0.0 brd 0.0.0.0 >> 5: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast >> state UNKNOWN group default qlen 100 >> link/none >> inet 172.18.73.1 peer 172.18.73.2/32 scope global tun0 >> valid_lft forever preferred_lft forever >> inet6 fe80::8c31:575c:4950:fa28/64 scope link stable-privacy >> valid_lft forever preferred_lft forever >> 6: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast >> state UNKNOWN group default qlen 100 >> link/none >> inet 172.18.73.1 peer 172.18.73.2/32 scope global tun1 >> valid_lft forever preferred_lft forever >> inet6 fe80::e403:923b:5769:5de/64 scope link stable-privacy >> valid_lft forever preferred_lft forever
